Due to business, security, regulatory or governmental requirements, customer data which is stored but is obsolete or no longer needed may need to be securely erased or deleted in such a way as to be unrecoverable (known as data shredding). Shredding involves overwriting the areas of the physical media on which the customer data is stored. Overwriting typically replaces the data with one of a variety of bit patterns, such as all 0's, all 1's. Moreover, because errors may occur during an overwrite operation, some security protocols require more than one overwrite pass to ensure that no remnant of the original data remains. Thus, one governmental shredding policy requires that a specified pattern be written seven times. Another, more stringent, policy requires that the data be overwritten with its complement, then overwritten by all 1's, then overwritten by all 0's, and then finally overwritten by a specified pattern seven times. Other shredding policies are also in use and may vary by application and regulating authority.
In the past, tape drives and optical drives have implemented fixed commands which perform an overwrite or erase entire volumes in a fixed pattern. Newer data retention products, such as the IBM® Data Retention 450, are being based on magnetic disk drives and include servers (or hosts) and external disk controllers. FIG. 1 is a block diagram of an exemplary data retention device 100, including a host 110, a storage controller 120 and attached disk drives (which may comprise a RAID array) 130. Software 122 within the host 120 tracks which sectors of a logical volume are to be shredded and directs the execution of the shredding operation.
The fixed erase commands which have been used in the past to destroy data from tape and optical drives are not flexible enough to satisfy the newer and varying regulatory shredding requirements. Furthermore, in order to overwrite a data sector, the host must send the overwriting pattern to the storage controller as if it was actual data. In a network environment, transmission of such data uses expensive bandwidth.
Additionally, in a storage array 130, sectors of a logical volume are typically spread across multiple physical drives of the array 130. It may be that one of the drives is offline or in a degraded state, a situation which is known to the controller 120 but not to the host 110. In such an event, data on the offline or degraded drive remains unshredded although the host 110 believes that the shredding operation was successful.
Consequently, a need exists for a flexible shredding system which accommodates various shredding requirements, reduces bandwidth requirements and takes into account offline or degraded drives.